Redefine CERTIFICATE_REQUEST to lean on TLS harder

[martinthomson]

This takes the block we had and says "take the extensions from a TLS CertificateRequest" instead. The nice trick here is that we can use SNI from the client side rather than leaning on the OID thing, which was always a long-shot.

[grittygrease]

LGTM

[MikeBishop]

I missed that you had an open PR for these changes -- sorry. I think in the meantime, I've made equivalent changes because you suggested them in e-mail.